Service account: Update service accounts creation (#51848)

pkg/services/serviceaccounts/api/api_test.go

@@ -58,8 +58,8 @@ func TestServiceAccountsAPI_CreateServiceAccount(t *testing.T) {
 	}
 	testCases := []testCreateSATestCase{
 		{
-			desc:   "should be ok to create serviceaccount with permissions",
-			body:   map[string]interface{}{"name": "New SA"},
+			desc:   "should be ok to create service account with permissions",
+			body:   map[string]interface{}{"name": "New SA", "role": "Viewer", "is_disabled": "false"},
 			wantID: "sa-new-sa",
 			acmock: tests.SetupMockAccesscontrol(
 				t,
@@ -70,6 +70,33 @@ func TestServiceAccountsAPI_CreateServiceAccount(t *testing.T) {
 			),
 			expectedCode: http.StatusCreated,
 		},
+		{
+			desc:   "should fail to create a service account with higher privilege",
+			body:   map[string]interface{}{"name": "New SA HP", "role": "Admin"},
+			wantID: "sa-new-sa-hp",
+			acmock: tests.SetupMockAccesscontrol(
+				t,
+				func(c context.Context, siu *models.SignedInUser, _ accesscontrol.Options) ([]accesscontrol.Permission, error) {
+					return []accesscontrol.Permission{{Action: serviceaccounts.ActionCreate}}, nil
+				},
+				false,
+			),
+			expectedCode: http.StatusForbidden,
+		},
+		{
+			desc:      "should fail to create a service account with invalid role",
+			body:      map[string]interface{}{"name": "New SA", "role": "Random"},
+			wantID:    "sa-new-sa",
+			wantError: "invalid role value: Random",
+			acmock: tests.SetupMockAccesscontrol(
+				t,
+				func(c context.Context, siu *models.SignedInUser, _ accesscontrol.Options) ([]accesscontrol.Permission, error) {
+					return []accesscontrol.Permission{{Action: serviceaccounts.ActionCreate}}, nil
+				},
+				false,
+			),
+			expectedCode: http.StatusBadRequest,
+		},
 		{
 			desc:      "not ok - duplicate name",
 			body:      map[string]interface{}{"name": "New SA"},
@@ -97,7 +124,7 @@ func TestServiceAccountsAPI_CreateServiceAccount(t *testing.T) {
 			expectedCode: http.StatusBadRequest,
 		},
 		{
-			desc: "should be forbidden to create serviceaccount if no permissions",
+			desc: "should be forbidden to create service account if no permissions",
 			body: map[string]interface{}{},
 			acmock: tests.SetupMockAccesscontrol(
 				t,